S4UTomato

S4UTomato Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost...

RFCpwn

RFCpwn An SAP enumeration and exploitation toolkit using SAP RFC calls Twitter: @icryo This is a toolkit for demonstrating the impact of compromised service accounts. This PoC is not for use in production environments, no guarantee of stability or support. RFCpwn relies on the pyrfc and the...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

patchy

Patchy Automated lateral movement and persistence by abusing GCP OS patch management based on my blog post. Patchy is made up of two main modes, lateral movement, and persistence. Persistence uses valid service account credentials to create a patch job or deployment. Lateral movement attempts to...

pytmipe

PYTMIPE & TMIPE PYTMIPE PYthon library for Token Manipulation and Impersonation for Privilege Escalation is a Python 3 library for manipulating Windows tokens and managing impersonations in order to gain more privileges on Windows. TMIPE is the python 3 client which uses the pytmipe library...

EUVD-2026-87715

Capgo CLI npm package @capgo/cli through 7.98.2 is affected by an over-permissioned service account in its Android onboarding flow. When onboarding via Google OAuth, the CLI invites the generated Google Play service account with the account-wide Play Console permission CANMANAGEDRAFTAPPSGLOBAL...

juicy-potato

Juicy Potato 황금 권한 남용 RottenPotatoNG의 달콤한 버전으로, 약간의 주스가 첨가되었습니다. 즉, Windows 서비스 계정에서 NT AUTHORITY\SYSTEM으로의 또 다른 로컬 권한 상승 도구 입니다 요약 RottenPotatoNG 및 그 변종은 BITS 서비스가 127.0.0.1:6666에서 MiTM 리스너를 가지고 있고 SeImpersonate 또는 SeAssignPrimaryToken 권한이 있을 때의 권한 상승 체인을 활용합니다. Windows 빌드 검토 중에 BITS가 의도적으로 비활성화...

JuicyPotatoNG

JuicyPotatoNG サービスアカウントからシステムへの、もう一つのWindowsローカル権限昇格ツールです。詳細は -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ 使用方法 root@kitploit: JuicyPotatoNG by decoderit & splintercode Mandatory args: -t createprocess call: CreateProcessWithTokenW, CreateProcessAsUser, tr...

StopDefender

StopDefender TrustedInstaller と Windefend サービスアカウントを使用して新しいトークンを作成し、プログラムによって Windows Defender を停止します。 ボタン1つで停止アクションを実行できます。コマンドラインオプションや PID を指定する必要はありません。Post Exploitation フレームワークとの統合に便利です。 ブログ記事 https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/ プレゼンテーション...

peirates

Peirates Peirates란 무엇인가? Kubernetes 침투 도구인 Peirates는 공격자가 권한을 상승시키고 Kubernetes 클러스터를 통해 피벗할 수 있게 해줍니다. 이 도구는 서비스 계정 토큰과 시크릿을 탈취 및 수집하고, 추가적인 코드 실행 권한을 획득하며, 클러스터의 제어권을 장악하기 위한 알려진 기법들을 자동화합니다. Peirates는 어디에서 실행하나요? Peirates는 Kubernetes에서 실행 중인 컨테이너 내부에서, 또는 컨테이너 외부의 Kubernetes 노드에서 실행합니다. Peirate...

gcp_scanner

면책 조항 이 프로젝트는 공식 Google 프로젝트가 아닙니다. Google에서 지원하지 않으며 Google은 특히 이 프로젝트의 품질, 상업성 또는 특정 목적에의 적합성에 대한 모든 보증을 부인합니다. GCP 스캐너 이것은 특정 자격 증명이 GCP에서 어떤 수준의 액세스 권한을 가지고 있는지 확인하는 데 도움을 주는 GCP 리소스 스캐너입니다. 이 스캐너는 보안 엔지니어가 특정 VM/컨테이너 손상, GCP 서비스 계정 또는 OAuth2 토큰 키 유출의 영향을 평가하는 데 도움이 되도록 설계되었습니다. 현재 스캐너는 다음 GC...

CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-66078 RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

CVE-2026-84884

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token...

CVE-2026-84884 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token...

EUVD-2026-87104

IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an administrative REST access token...

CVE-2026-21008-Kubernetes-Service-Account-Token-Mounted-in-HostPath

CVE-2026-21008 – hostPath にマウントされた Kubernetes Service Account トークン プログラムコード（YAML + Python エクスプロイト） root@kitploit: vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath apiVersion: v1 kind: Pod metadata: name: sa-token-leak spec: containers: - name: ap...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

PrintSpoofer

PrintSpoofer Windows Server 2016、Server 2019、および Windows 10 において、サービスユーザーの権限を昇格するために使用できる PrintSpoofer エクスプロイトです。 権限を昇格するには、サービスアカウントに SeImpersonate 権限が必要です。実行するには： PrintSpoofer.exe -i -c cmd 適切な権限があれば、これによりシステムユーザーのシェルアクセスが付与されます。...